diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5873d8e..dadc748 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,8 +76,7 @@ jobs:
           "$DEST/sfetch" --version
 
   # Dual-route consumer matrix: action thin-wraps the shared engine.
-  # v0.4.10 exercises sha256sums (backward pin). minisig route is unit-tested
-  # until v0.4.11 is published; after publish, add sfetch-version: v0.4.11 here.
+  # Default pin exercises minisig (v0.4.11+). Ubuntu also proves sha256sums on v0.4.10.
   setup-sfetch-matrix:
     name: setup-sfetch (${{ matrix.os }})
     strategy:
@@ -93,10 +92,10 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - name: Setup sfetch via composite action (v0.4.10 sha256sums route)
+      - name: Setup sfetch via composite action (v0.4.11 minisig route)
         uses: ./.github/actions/setup-sfetch
         with:
-          sfetch-version: v0.4.10
+          sfetch-version: v0.4.11
 
       - name: Assert sfetch on PATH
         shell: bash
@@ -105,7 +104,7 @@ jobs:
           command -v sfetch
           # sfetch --version writes to stderr (not stdout)
           sfetch --version 2>&1 | tee /tmp/sfetch-ver.txt
-          grep -E '0\.4\.10' /tmp/sfetch-ver.txt
+          grep -E '0\.4\.11' /tmp/sfetch-ver.txt
 
       - name: Fail-closed optional tool (goneat not requested)
         shell: bash
@@ -124,7 +123,7 @@ jobs:
           set -euo pipefail
           # Request a non-existent goneat tag; engine must exit non-zero (no soft skip).
           if ./scripts/bootstrap-sfetch-verified.sh \
-              --version v0.4.10 \
+              --version v0.4.11 \
               --dir "$RUNNER_TEMP/goneat-fail" \
               --goneat-version v0.0.0 \
               --yes; then
@@ -133,6 +132,21 @@ jobs:
           fi
           echo "requested-goneat failure path OK"
 
+      - name: Backward pin v0.4.10 sha256sums route (ubuntu only)
+        if: runner.os == 'Linux'
+        uses: ./.github/actions/setup-sfetch
+        with:
+          sfetch-version: v0.4.10
+          install-dir: ${{ runner.temp }}/sfetch-v0410
+
+      - name: Assert backward pin binary
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          "${RUNNER_TEMP}/sfetch-v0410/sfetch" --version 2>&1 | tee /tmp/sfetch-0410.txt
+          grep -E '0\.4\.10' /tmp/sfetch-0410.txt
+
       - name: Reject floating sfetch-version
         shell: bash
         run: |
diff --git a/Makefile b/Makefile
index ecd651e..181f7b0 100644
--- a/Makefile
+++ b/Makefile
@@ -45,7 +45,7 @@ BIN_DIR := $(CURDIR)/bin
 # pin (see .github/workflows/ci.yml). Always a fully-signed published release —
 # never "latest" and never the in-flight cut — so main CI cannot 404 during the
 # tag/upload window. Advance after each release publishes + signs.
-SFETCH_VERSION := v0.4.10
+SFETCH_VERSION := v0.4.11
 GONEAT_VERSION ?= v0.5.15
 GOVULNCHECK_VERSION ?= v1.6.0
 
@@ -85,9 +85,8 @@ help: ## Show this help
 # Trust chain: verified bootstrap script -> sfetch (N-1 pin) -> goneat
 #
 # N-1 pin (SFETCH_VERSION) is always a published release — never this cut.
-# At v0.4.11 the N-1 pin is v0.4.10, which has no install-sfetch.sh.minisig,
-# so the shared engine takes the signed SHA256SUMS route. From v0.4.12 onward
-# (when N-1 >= v0.4.11) the engine switches to the detached .minisig route.
+# N-1 pin is a published release. At/after v0.4.11 the engine takes the
+# detached install-sfetch.sh.minisig route when N-1 >= MINISIG_SINCE (v0.4.11).
 #
 # Do not pipe curl | bash here — that is the anti-pattern this release fixes.